diff --git a/docs/directorymanager/11.1/admincenter/identitystore/create.md b/docs/directorymanager/11.1/admincenter/identitystore/create.md index b6f0e6b18d..bff2ecedbd 100644 --- a/docs/directorymanager/11.1/admincenter/identitystore/create.md +++ b/docs/directorymanager/11.1/admincenter/identitystore/create.md @@ -7,7 +7,7 @@ sidebar_position: 10 # Create an Identity Store To perform group and identity management operations in an identity provider using Directory Manager, -the first step is to create an identity store for that provider. +first create an identity store for that provider. You can create identity stores for the following providers: @@ -16,22 +16,20 @@ You can create identity stores for the following providers: - Generic LDAP - Google Workspace -To create an identity store, you have to specify an identity provider and its connection details. +To create an identity store, you must specify an identity provider and its connection details. -After creating an identity store, you must configure certain settings for it. These configurations -are discussed in the [Configure an Identity Store](/docs/directorymanager/11.1/admincenter/identitystore/configure/configure.md) topic. +After creating an identity store, you must configure certain settings for it. For these +configurations, see the [Configure an Identity Store](/docs/directorymanager/11.1/admincenter/identitystore/configure/configure.md) topic. ## Create an Identity Store for Active Directory -Follow the steps to create an identity store for Active Directory. - Step 1 – In Admin Center, click **Identity Stores** in the left pane. Step 2 – On the Identity Stores page, click **Create Identity Store** in the top right corner. -Step 3 – On the Create Identity Store page, use the Store Type drop-down list to select an identity +Step 3 – On the Create Identity Store page, use the Store Type dropdown list to select an identity provider to create an identity store for. -This list displays the supported providers. By default, Active Directory is selected. Fields on this +This list displays the supported providers. Active Directory is the default selection. Fields on this page vary, depending on the provider you select. Step 4 – Enter a name for the identity store in the Name box. @@ -43,33 +41,33 @@ Step 6 – In theService Accout box, enter the username of a service account or service account (gMSA) to connect to Active Directory. - For a service account – The service account must have sufficient privileges on the provider to - facilitate group and identity management operations using Directory Manager. The minimum - permissions the service account requires for Active Directory are discussed in the + facilitate group and identity management operations using Directory Manager. For the minimum + permissions the service account requires for Active Directory, see the [Service Account for Active Directory and Exchange](/docs/directorymanager/11.1/requirements/permissions/adserviceaccount.md) topic. - For a gMSA – If you provide a service account with - ‘$’ as its last character (as in MyAdminAccounts$), Directory Manager entertains it as a Group + ‘$’ as its last character (as in MyAdminAccounts$), Directory Manager treats it as a Group Managed Service Account (gMSA). To use a gMSA to connect an identity store to Active Directory, - make sure the gMSA is configured properly and has sufficient permissions. See the + ensure the gMSA is configured properly and has sufficient permissions. See the [gMSA for Active Directory](/docs/directorymanager/11.1/requirements/permissions/gmsarequirements.md) topic. Step 7 – In the **Service Account Password** box, enter the service account password. Skip this box for a gMSA. -Step 8 – Select the **SSL Enabled** check box if the directory server is LDAP over SSL enabled. +Step 8 – Select the **SSL Enabled** checkbox if the directory server is LDAP over SSL enabled. :::note Directory Manager 11 supports LDAPS; however, the Replication Service will still connect to -the domain controller via the LDAP 389 port. Hence, both LDAP and LDAPS protocols must be enabled on +the domain controller via the LDAP 389 port. Therefore, enable both the LDAP and LDAPS protocols on the domain controller. ::: -Step 9 – Click **Create Identity Store**. The **Replicate Identity Store** message is displayed. +Step 9 – Click **Create Identity Store**. The **Replicate Identity Store** message appears. Select: -- Later – replicates all the objects to Elasticsearch at the next due replication time as per the - replication settings. +- Later – replicates all the objects to Elasticsearch at the next due replication time, according to + the replication settings. - Replicate Now – replicates all the objects to Elasticsearch now. The identity store is available on the Identity Stores page. You can specify different @@ -81,13 +79,13 @@ In Admin Center, click **Identity Stores** in the left pane. Step 1 – On the Identity Stores page, click **Create Identity Store** in the top right corner. -Step 2 – On the Identity Stores page, use the Store Type drop-down list to select an identity +Step 2 – On the Identity Stores page, use the Store Type dropdown list to select an identity provider to create an identity store for. This list displays the supported providers. Select _Microsoft Azure_. Step 3 – Enter a name for the identity store in the Name box. -Step 4 – From the Cloud drop-down list, select the cloud where your Microsoft Entra ID tenant +Step 4 – From the Cloud dropdown list, select the cloud where your Microsoft Entra ID tenant exists. Step 5 – In the Domain Name box, enter the fully qualified name of the Microsoft Entra ID domain you @@ -95,12 +93,12 @@ want to create the identity store for. Step 6 – Specify the path to the .pfx certificate in the PFX Certificate box. For that, click **Choose File** and browse for the file. Select it and click **Open**. -As a prerequisite, the .pfx certificate must be generated on the Directory Manager machine. See the +As a prerequisite, you must generate the .pfx certificate on the Directory Manager machine. See the [Certificate for Entra ID Authentication ](/docs/directorymanager/11.1/configureentraid/register/modauth.md)topic for information on generating a certificate and then converting it into the .pfx format. -Step 7 – In the PFX Certificate Password box, enter the password that was created while exporting -the .pfx certificate. +Step 7 – In the PFX Certificate Password box, enter the password you created while exporting the +.pfx certificate. Step 8 – In the Registered Application ID on Azure Active Directory box, enter the application ID assigned to the Directory Manager application when you registered it in Microsoft Entra Admin @@ -112,14 +110,14 @@ Directory Manager application. Step 10 – If you bind a custom domain with your Microsoft Entra ID tenant and create an identity store for Microsoft Entra ID using the credentials of that custom domain, then you must provide the -name of the primary domain in the **Primary Domain Name** box, so that the _write_ operations are -not affected. +name of the primary domain in the **Primary Domain Name** box, to avoid affecting _write_ +operations. -Step 11 – Click **Create Identity Store**. The Replicate Identity Store message is displayed. +Step 11 – Click **Create Identity Store**. The Replicate Identity Store message appears. Select: -- Later – replicates all the objects to Elasticsearch at the next due replication time as per the - replication settings. +- Later – replicates all the objects to Elasticsearch at the next due replication time, according to + the replication settings. - Replicate Now – replicates all the objects to Elasticsearch now. The identity store is available on the Identify Stores page. You can specify different @@ -127,25 +125,22 @@ configurations for it. :::note Microsoft’s throttling policy restricts an application (such as Directory Manager) to create a -maximum of 3 concurrent sessions with Microsoft Entra ID. With this in view, Directory Manager -allows only one active session at any given time, which is used by Data service and Replication -service. +maximum of 3 concurrent sessions with Microsoft Entra ID. Therefore, Directory Manager allows only +one active session at any given time, which the Data service and the Replication service share. ::: ## Create an Identity Store for Generic LDAP Create a Generic LDAP identity store to connect to any LDAP version 3-compliant directory server, -such as Sun ONE directory server. This provider does not support dynamic schema detection. The +such as Sun ONE directory server. This provider doesn't support dynamic schema detection. The schema included for this provider mostly contains commonly used fields. -**Follow the steps to create an identity store** - Step 1 – In Admin Center, click **Identity Stores** in the left pane. Step 2 – On the **Identity Stores** page, click **Create Identity Store** in the top right corner. -Step 3 – On the **Create Identity Store** page, use the **Store Type** drop-down list to select an +Step 3 – On the **Create Identity Store** page, use the **Store Type** dropdown list to select an identity provider to create an identity store for. This list displays the supported providers. Select _Generic LDAP_. @@ -154,8 +149,8 @@ Step 4 – Enter a name for the identity store in the **Name** box. Step 5 – In the **Hostname** box, enter the fully qualified domain name or IP address of the machine that hosts the generic LDAP server. -Step 6 – In the **Port Number** box, enter the port on which LDAP is running. This port is used to -communicate with the host machine. +Step 6 – In the **Port Number** box, enter the port on which LDAP is running. Directory Manager uses +this port to communicate with the host machine. Step 7 – In the **Domain Name** box, enter the fully qualified name of the domain you want to create the identity store for. @@ -167,11 +162,11 @@ operations using Directory Manager. Step 9 – In the **Service Account Password** box, enter the service account password. -Step 10 – Click **Create Identity Store**. The **Replicate Identity Store** message is displayed. +Step 10 – Click **Create Identity Store**. The **Replicate Identity Store** message appears. Select: -- Later – replicates all the objects to Elasticsearch at the next due replication time as per the - replication settings. +- Later – replicates all the objects to Elasticsearch at the next due replication time, according to + the replication settings. - Replicate Now – replicates all the objects to Elasticsearch now. The identity store is available on the Identity Stores page. You can specify different @@ -179,11 +174,34 @@ configurations for it. ## Create an Identity Store for Google Workspace +### Required Google Cloud / Workspace setup + +- In Google Cloud Console, enable the following APIs for your service account: + - Admin SDK API (admin.googleapis.com) + - Cloud Identity (cloudidentity.googleapis.com) + - Groups Settings API (groupssettings.googleapis.com) +- The service account that Directory Manager uses authenticates to Google Workspace through + domain-wide delegation — a server-to-server method that lets the service account act on behalf of + Workspace users and administrators without an interactive sign-in. Because this bypasses the + per-user consent screen, a Workspace super administrator must pre-authorize every OAuth scope that + the service account uses. In the Google Workspace Admin panel, add the following scopes to your + service account: + - https://www.googleapis.com/auth/admin.directory.group + - https://www.googleapis.com/auth/admin.directory.orgunit + - https://www.googleapis.com/auth/admin.directory.rolemanagement + - https://www.googleapis.com/auth/admin.directory.user + - https://www.googleapis.com/auth/admin.directory.userschema + - https://www.googleapis.com/auth/admin.reports.audit.readonly + - https://www.googleapis.com/auth/apps.groups.settings + - https://www.googleapis.com/auth/cloud-identity.groups + +### Create Identity Store + Step 1 – In Admin Center, click **Identity Stores** in the left pane. Step 2 – On the Identify Stores page, click **Create Identity Store** in the top right corner. -Step 3 – On the Create Identity Store page, use the Store Type drop-down list to select an identity +Step 3 – On the Create Identity Store page, use the Store Type dropdown list to select an identity provider to create an identity store for. This list displays the supported providers. Select _Google Workspace_. @@ -203,13 +221,13 @@ To generate the key, see Step 8 – Specify the path to the p12 key file in the P12 Certificatebox. For that, click **Choose File** and browse for the file. Select it and click **Open**. -As a prerequisite, the p12 key file for your account must be generated in Google Cloud Console and -downloaded to a machine. +As a prerequisite, you must generate the p12 key file for your account in Google Cloud Console and +download it to a machine. -Step 9 – Click **Create Identity Store**. The Replicate Identity Store message is displayed. Select: +Step 9 – Click **Create Identity Store**. The Replicate Identity Store message appears. Select: -- Later – replicates all the objects to Elasticsearch at the next due replication time as per the - replication settings. +- Later – replicates all the objects to Elasticsearch at the next due replication time, according to + the replication settings. - Replicate Now – replicates all the objects to Elasticsearch now. The identity store is available on the Identity Stores page. You can specify different